Actually enrich StatefulSets in mutating webhooks

Many parts copied from https://github.com/stackabletech/commons-operator/tree/spike/sts-restarter-webhook

Co-authored-by: Natalie Klestrup Röijezon <nat@nullable.se>

Author: sbernauer

Cargo.lock

@@ -17,6 +17,7 @@ built = { version = "0.8", features = ["chrono", "git2"] }
 clap = "4.5"
 futures = { version = "0.3", features = ["compat"] }
 http = "1.3"
+json-patch = "4.1"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 snafu = "0.8"

Cargo.nix

@@ -1,3 +1,32 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx
+  labels:
+    app: nginx
+spec:
+  ports:
+  - port: 80
+    name: web
+  clusterIP: None
+  selector:
+    app: nginx
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: web-config
+data:
+  foo: bar
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: web-config-2
+data:
+  foo: bar
+---
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
@@ -32,31 +61,3 @@ spec:
         - name: config
           configMap:
             name: web-config
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: nginx
-  labels:
-    app: nginx
-spec:
-  ports:
-  - port: 80
-    name: web
-  clusterIP: None
-  selector:
-    app: nginx
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: web-config
-data:
-  foo: bar
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: web-config-2
-data:
-  foo: bar

Cargo.toml

@@ -15,6 +15,7 @@ anyhow.workspace = true
 clap.workspace = true
 http.workspace = true
 futures.workspace = true
+json-patch.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 snafu.workspace = true

_TEST.yaml

@@ -5,6 +5,7 @@
 use anyhow::anyhow;
 use clap::Parser;
 use futures::{FutureExt, TryFutureExt};
+use restart_controller::statefulset::create_context;
 use stackable_operator::{
     YamlSchema as _,
     cli::{Command, RunArguments},
@@ -19,6 +20,7 @@ use stackable_operator::{
 use webhooks::create_webhook;
 
 mod restart_controller;
+mod utils;
 mod webhooks;
 
 mod built_info {
@@ -82,7 +84,19 @@ async fn main() -> anyhow::Result<()> {
             )
             .await?;
 
+            let (ctx, cm_store_tx, secret_store_tx) = create_context(client.clone());
+            let sts_restart_controller = restart_controller::statefulset::start(
+                ctx.clone(),
+                cm_store_tx,
+                secret_store_tx,
+                &watch_namespace,
+            )
+            .map(anyhow::Ok);
+            let pod_restart_controller =
+                restart_controller::pod::start(&client, &watch_namespace).map(anyhow::Ok);
+
             let webhook = create_webhook(
+                ctx,
                 &operator_environment,
                 // TODO: Make user configurable
                 false,
@@ -93,16 +107,11 @@ async fn main() -> anyhow::Result<()> {
                 .run()
                 .map_err(|err| anyhow!(err).context("failed to run webhook"));
 
-            let sts_restart_controller =
-                restart_controller::statefulset::start(&client, &watch_namespace).map(anyhow::Ok);
-            let pod_restart_controller =
-                restart_controller::pod::start(&client, &watch_namespace).map(anyhow::Ok);
-
             futures::try_join!(
                 sts_restart_controller,
                 pod_restart_controller,
+                webhook,
                 eos_checker,
-                webhook
             )?;
         }
     }

crate-hashes.json

@@ -42,7 +42,7 @@ enum Error {
     #[snafu(display(
         "failed to parse expiry timestamp annotation ({annotation:?}: {value:?}) as RFC 3999"
     ))]
-    UnparseableExpiryTimestamp {
+    UnparsableExpiryTimestamp {
         source: chrono::ParseError,
         annotation: String,
         value: String,
@@ -60,7 +60,7 @@ impl ReconcilerError for Error {
         match self {
             Error::PodHasNoName => None,
             Error::PodHasNoNamespace => None,
-            Error::UnparseableExpiryTimestamp {
+            Error::UnparsableExpiryTimestamp {
                 source: _,
                 annotation: _,
                 value: _,
@@ -73,6 +73,8 @@ impl ReconcilerError for Error {
 pub async fn start(client: &Client, watch_namespace: &WatchNamespace) {
     let controller = Controller::new(
         watch_namespace.get_api::<PartialObjectMeta<Pod>>(client),
+        // TODO: Can we only watch a subset of Pods with a specify label, e.g.
+        // vendor=Stackable to reduce the memory footprint?
         watcher::Config::default(),
     );
     let event_recorder = Arc::new(Recorder::new(
@@ -124,7 +126,7 @@ async fn reconcile(pod: Arc<PartialObjectMeta<Pod>>, ctx: Arc<Ctx>) -> Result<Ac
         .flatten()
         .filter(|(k, _)| k.starts_with("restarter.stackable.tech/expires-at."))
         .map(|(k, v)| {
-            DateTime::parse_from_rfc3339(v).context(UnparseableExpiryTimestampSnafu {
+            DateTime::parse_from_rfc3339(v).context(UnparsableExpiryTimestampSnafu {
                 annotation: k,
                 value: v,
             })